drop sspm + iam exports · correlate saas app to identity grant · runs locally
drop sspm + iam exports · local only
heuristic screener · vendor schema varies · not definitive proof